lokibot | cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3

General

Target

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
Size

536KB
MD5

2402f165befaa33e3700592cb7defe4c
SHA1

e1c0b072bf018dc8af85ff4972a7e0718a4c7bf7
SHA256

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3
SHA512

ff5f1dac40696ba5875abd8baad70b6b5c2fad8485530c6a09217c5d1ce9cd57b761861aa4d07998b13f12f85353336332649b3b6fa036489cd95d8a5a89e322

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

https://luoslasco.xyz/to/ya/vd.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

description	pid	process	target process
PID 652 set thread context of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

pid process

748 cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

description pid process

Token: SeDebugPrivilege 748 cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

pid	process
748	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

description	pid	process
Token: SeDebugPrivilege	748	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

description	pid	process	target process
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 652 wrote to memory of 748	652	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

C:\Users\Admin\AppData\Local\Temp\cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
"C:\Users\Admin\AppData\Local\Temp\cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652

C:\Users\Admin\AppData\Local\Temp\cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
"{path}"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-114-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/652-116-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/652-117-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/652-118-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/652-119-0x0000000004CD0000-0x00000000051CE000-memory.dmp

Filesize
5.0MB

Download
memory/652-120-0x0000000005120000-0x0000000005122000-memory.dmp

Filesize
8KB

Download
memory/652-121-0x0000000008310000-0x0000000008311000-memory.dmp

Filesize
4KB

Download
memory/652-122-0x00000000068E0000-0x000000000694B000-memory.dmp

Filesize
428KB

Download
memory/652-123-0x00000000067C0000-0x00000000067E2000-memory.dmp

Filesize
136KB

Download
memory/748-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/748-125-0x00000000004139DE-mapping.dmp

Download
memory/748-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing